fix(install): write standing settings.system.json snapshot on hooks install (#1402)

[sauldataman]

Problem

Addresses #1402. MemoryHealthCheck.ts CHECK 3 treats ~/.claude/settings.system.json as the standing source of truth for system hook wiring and requires the four memory hooks to be registered in it. But no
install step ever writes that file:

• install.sh never touches settings.
• InstallHooks.ts --apply merges the payload's hooks.json into settings.json, and copies the hook scripts to disk, but never produces the standing settings.system.json.

So on a fresh install the health check fails against a file that no step is responsible for creating:

CRITICAL — settings.system.json not found at ~/.claude/settings.system.json

(This is the "never written" variant of the contract gap in #1402; the "written without hooks" variant is the same missing producer seen from the other side.)

Fix

InstallHooks.ts --apply now also writes the standing snapshot to /settings.system.json:

• base = install/settings.system.json (the canonical system half — same file SettingsBackport.ts treats as the system layer)
• hooks = incoming (the payload's own wiring), not merged. Freezing a user's foreign hook entries into "system truth" would make MemoryHealthCheck misreport them as required system hooks.

Write-path (join(configRoot, "settings.system.json")) and the health check's read-path (join(HOME, ".claude", "settings.system.json")) resolve to the same location under a normal install; both use
process.env/os.homedir(), so this is not affected by the literal-$HOME issue in #1404.

Scope / semantics

• Dry-run unchanged — the snapshot is only written under --apply, after the existing trust gate.
• Idempotent — re-running --apply reproduces byte-identical output.
• Refreshed on every --apply, so re-installs stay current. (A user who applied the manual workaround from 6.0.0: settings.system.json contract mismatch — payload ships it without hooks, MemoryHealthCheck requires hooks registered in it (fresh installs report CRITICAL) #1402 will have it replaced by the identical generated version.)
• Does not touch MemoryHealthCheck.ts — the check's source-of-truth semantics are correct; this supplies the missing producer.
• Applied to both copies of InstallHooks.ts (skill source + install payload mirror) and the two Setup.md step-7 doc lines.

Verification

Sandbox --config-root, then the real consumer with HOME overridden:

$ bun InstallHooks.ts --config-root $SBX --skill-root $SKILL --apply
$ bun InstallHooks.ts --config-root $SBX --skill-root $SKILL --apply
$ HOME=$SBX_HOME bun LIFEOS/TOOLS/MemoryHealthCheck.ts
CHECK 3 findings: none
ok: settings-hook-present:settings.system.json:MemoryReviewTrigger.hook.ts
ok: settings-hook-present:settings.system.json:MemoryReviewFire.hook.ts
ok: settings-hook-present:settings.system.json:MemoryHealthGate.hook.ts
ok: settings-hook-present:settings.system.json:MemoryDeltaSurface.hook.ts

Dry-run writes no snapshot; second --apply is byte-identical to the first.